@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/platform-diff.js

@@ -5,7 +5,9 @@ import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
+import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -22,6 +24,7 @@ export function toPlatformPlan(detail, ownerOrgId) {
         steps: detail.plannedSteps.map((p) => p.step),
         unmanaged: detail.unmanaged,
         versionChanges: detail.versionChanges,
+        notes: detail.notes,
     };
 }
 function resourceKey(system, kind, key) {
@@ -195,12 +198,11 @@ export const PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY = 'archon_deployment';
  */
 export const PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY = 'archon_applied_broker_app';
 /**
- * The `AUTHZ_BOOTSTRAP_OPERATOR` the last Archon apply set (`none` when it set
- * none). `planArchon` plans the step again when the owner's id recorded by
- * `platform:auth` differs from it, so Archon picks the owner up once auth
- * has recorded it.
+ * The sign-in org id the last Archon apply set as `AUTH_ORGANIZATION_ID` and
+ * registered its broker entry under. `planArchon` plans the step again when
+ * {@link archonAuthOrganizationId} differs from it.
  */
-export const PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY = 'archon_applied_bootstrap_operator';
+export const PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY = 'archon_applied_auth_org';
 /**
  * #475: whether the last successful Archon apply patched the app with
  * `custom_network_aliases` and `is_consistent_container_name_enabled: false`
@@ -217,13 +219,15 @@ export const PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY = 'archon_applied_bootst
  */
 export const PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY = 'archon_applied_rolling_update';
 /**
- * The owner's ZITADEL user id Archon takes as its first operator, from
- * {@link PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY}. Undefined when none is
- * recorded or the recorded value is `none` (no owner declared).
+ * The sign-in org Archon accepts: the platform owner company's own
+ * ({@link PLATFORM_OWNER_ORG_SCOPE_KEY}), else the platform's `foundry` org for
+ * a platform with no owner company declared. Undefined when neither is recorded.
  */
-export function archonBootstrapOperator(recorded) {
-    const id = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
-    return id && id !== 'none' ? id : undefined;
+export function archonAuthOrganizationId(recorded) {
+    const owner = recorded[PLATFORM_OWNER_ORG_SCOPE_KEY];
+    if (owner && owner !== 'none')
+        return owner;
+    return recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] || undefined;
 }
 /**
  * #175: set to '1' before the step points the tunnel at `http_status:404`
@@ -244,6 +248,26 @@ export const PLATFORM_AUTH_SMTP_SCOPE_KEY = 'zitadel_platform_smtp_provider_id';
  * requested, so the invite goes out once. `none` when no owner is declared.
  */
 export const PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY = 'zitadel_platform_owner_invite_user_id';
+/** The platform's own ZITADEL org (`foundry`, the one `provisionPlatformAuth` mints its admin user in). */
+export const PLATFORM_ZITADEL_ORG_SCOPE_KEY = 'zitadel_platform_org';
+/**
+ * The id of the platform owner company's own sign-in organisation, made by
+ * `platform:auth` with the same name and primary domain a company apply uses,
+ * so that apply finds this org and makes no second one. `none` when the owner
+ * company is not declared. Archon signs people in from this org; the
+ * `foundry` org ({@link PLATFORM_ZITADEL_ORG_SCOPE_KEY}) holds no people.
+ */
+export const PLATFORM_OWNER_ORG_SCOPE_KEY = 'zitadel_platform_owner_org';
+/** The primary domain `platform:auth` registered on the owner company's sign-in org. */
+export const PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY = 'zitadel_platform_owner_org_domain';
+/** The owner org's sign-in domain the sign-in server refused to make primary; set instead of failing, reported as blocked. */
+export const PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY = 'zitadel_platform_owner_org_domain_blocked';
+/**
+ * The sign-in org the recorded owner invite ({@link PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY})
+ * was made in. An invite recorded against another org (the `foundry` org, on a
+ * platform applied before the owner moved) plans the auth step again.
+ */
+export const PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY = 'zitadel_platform_owner_invite_org';
 /**
  * #394: the id of the role-less ZITADEL machine user that reserves the
  * username `admin` in the platform's own org, so nobody can sign up under a
@@ -253,8 +277,6 @@ export const PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY = 'zitadel_platform_owner_invi
 export const PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY = 'zitadel_platform_reserved_admin_username';
 /** #394: recorded once the platform's own ZITADEL org has self-registration forced off. */
 export const PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_platform_registration_closed';
-/** The platform's own ZITADEL org (`foundry`, the one `provisionPlatformAuth` mints its admin user in). */
-export const PLATFORM_ZITADEL_ORG_SCOPE_KEY = 'zitadel_platform_org';
 export const PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY = 'zitadel_platform_admin_user_id';
 export const PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY = 'zitadel_platform_admin_user_undelivered';
 /** #283: the created instance's id, recorded once its owner token is delivered. */
@@ -461,6 +483,26 @@ export const PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY = 'mail_applied_git_ref';
  * no key and creates nothing in the sign-in server.
  */
 export const PLATFORM_MAIL_ROUTE_SCOPE_KEY = 'mail_route_applied';
+/**
+ * The host ports the platform Stalwart publishes, as the mapping string the
+ * last apply set on its app. Without the shared relay it binds SMTP port 25
+ * itself; with `mail.relay` it keeps only submission, because the relay owns
+ * port 25. A missing record means the mapping it was created with, `25:25,...`.
+ */
+export const PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY = 'mail_host_ports_applied';
+export const PLATFORM_MAIL_HOST_PORTS_DIRECT = '25:25,465:465,587:587';
+export const PLATFORM_MAIL_HOST_PORTS_RELAY = '465:465,587:587';
+export function platformMailHostPorts(platform) {
+    return platform.mail.relay === true
+        ? PLATFORM_MAIL_HOST_PORTS_RELAY
+        : PLATFORM_MAIL_HOST_PORTS_DIRECT;
+}
+function mailPortsApplied(platform, recordedIds) {
+    return ((recordedIds[PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY] ?? PLATFORM_MAIL_HOST_PORTS_DIRECT) ===
+        platformMailHostPorts(platform));
+}
+export { PLATFORM_MAIL_RELAY_KEY };
+export { PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, } from './mail-relay.js';
 export const PLATFORM_MAIL_ROUTE_WANTED = 'local-first';
 /**
  * #177: where the mail server answers on the Coolify network
@@ -1092,7 +1134,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, recordedIds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailPlatformDomains = [], mailRoutesBlocked = [], recordedIds = {}, blocked = {}, drifted = {}, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1138,7 +1180,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? []);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -1157,6 +1199,18 @@ export function planPlatform(platform, live, options = {}) {
     const mail = planMail(platform, recordedIds, blocked.mail ?? dnsBlocked?.('mail server'), authReady);
     if (mail.step)
         plannedSteps.push(mail.step);
+    // The shared relay owns host port 25 once `mail.relay` is on, so it runs after the
+    // mail step that gives the port up.
+    const relay = planMailRelay(platform, recordedIds, {
+        routes: mailRoutes,
+        platformDomains: mailPlatformDomains,
+        executorBlocked: blocked.relay,
+        mailReady: mail.step !== null ||
+            (Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_MAIL_KEY)]) &&
+                mailPortsApplied(platform, recordedIds)),
+    });
+    if (relay.step)
+        plannedSteps.push(relay.step);
     // #172: a throw halts every step after it, so this one goes late.
     const ai = planAi(platform, recordedIds, blocked.ai);
     if (ai.step)
@@ -1243,6 +1297,12 @@ export function planPlatform(platform, live, options = {}) {
     // A blocked jobs scheduler is reported here, not planned: a step that
     // throws every apply, or that can never be seen live and so re-plans
     // forever, is worse than none.
+    if (!platform.ownerOrgId) {
+        unmanaged.push({
+            description: "platform.ownerOrgId is not declared, so no org is the platform's own: no peer password or bridge secret is minted for any Boule and Archon reads no people",
+            key: 'owner-org',
+        });
+    }
     if (jobs.blocked)
         unmanaged.push({ description: jobs.blocked, key: 'jobs' });
     if (platform.sfu.enabled && sfuBlocked) {
@@ -1253,6 +1313,13 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: auth.blocked, key: 'auth' });
     if (mail.blocked)
         unmanaged.push({ description: mail.blocked, key: 'mail' });
+    if (relay.blocked)
+        unmanaged.push({ description: relay.blocked, key: 'mail-relay' });
+    if (platform.mail.relay === true) {
+        for (const description of mailRoutesBlocked) {
+            unmanaged.push({ description, key: 'mail-relay:route' });
+        }
+    }
     if (integrations.blocked)
         unmanaged.push({ description: integrations.blocked, key: 'integrations' });
     if (files.blocked)
@@ -1284,7 +1351,12 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: heartbeats.blocked, key: 'heartbeats' });
     for (const description of uptime.blocked)
         unmanaged.push({ description, key: 'uptime' });
-    return { plannedSteps: plannedSteps.map(withStepSystem), unmanaged, versionChanges };
+    return {
+        plannedSteps: plannedSteps.map(withStepSystem),
+        unmanaged,
+        versionChanges,
+        notes: uptime.notes,
+    };
 }
 /**
  * The platform's own Cloudflare zone for its shared apex (`platform.ts`'s
@@ -1703,9 +1775,12 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = []) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
+    // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
+    const standing = [ownerInviteBlocked, ownerDomainBlockedText(recordedIds)].filter((t) => Boolean(t));
+    const standingNote = standing.length > 0 ? standing.join('; ') : null;
     const key = resourceKey('coolify', 'app', PLATFORM_AUTH_KEY);
     const connectorApplied = Boolean(recordedIds[PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY]);
     // #211: a recorded app and connector with no recorded broker id is a
@@ -1739,11 +1814,18 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         // Mail and the owner's invite: a platform applied before they existed
         // plans the step again, which only adds them.
         Boolean(recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY]) &&
-        Boolean(recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY]) &&
+        (Boolean(recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY]) || Boolean(ownerInviteBlocked)) &&
+        // The owner company's own sign-in org, and an invite made in it: a
+        // platform whose owner was invited into the `foundry` org plans the step again.
+        Boolean(recordedIds[PLATFORM_OWNER_ORG_SCOPE_KEY]) &&
+        (Boolean(ownerInviteBlocked) ||
+            recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY] === 'none' ||
+            recordedIds[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY] ===
+                recordedIds[PLATFORM_OWNER_ORG_SCOPE_KEY]) &&
         // The ZITADEL run options reach the container only through the auth
         // step's redeploy, so a platform recorded before them still plans it.
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
-        return { step: null, blocked: null };
+        return { step: null, blocked: standingNote };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a
     // token once, so it is lost: minting another would hide that, and skipping
@@ -1814,6 +1896,7 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         // 5: and only claim "this apply re-mints" when `otherInputsMissing` is
         // actually empty -- see this function's own doc comment.
         blocked: executorBlocked ??
+            standingNote ??
             loginClientNeedsMintNote(loginClientUndelivered, loginClientApplied, authDrifted, loginClientRecord, otherInputsMissing),
     };
 }
@@ -1879,7 +1962,8 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
         // #177: a mail step applied before this key existed never recorded it, and
         // org steps read it for Agora's mail upstream. Missing means unapplied.
         recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
-        recordedIds[PLATFORM_MAIL_ROUTE_SCOPE_KEY] === PLATFORM_MAIL_ROUTE_WANTED) {
+        recordedIds[PLATFORM_MAIL_ROUTE_SCOPE_KEY] === PLATFORM_MAIL_ROUTE_WANTED &&
+        mailPortsApplied(platform, recordedIds)) {
         return { step: null, blocked: null };
     }
     // Only the route is missing: say so, the app is not redeployed.
@@ -1887,7 +1971,8 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
         recordedIds[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === platform.mail.hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === platform.mail.gitRef &&
-        recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY];
+        recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
+        mailPortsApplied(platform, recordedIds);
     // Stalwart's `x:ApiKey/set` shows a secret once. An id was minted but never
     // reached the host: report it, plan nothing, the same rule {@link planAuth}
     // follows for ZITADEL's own admin key.
@@ -2487,9 +2572,9 @@ function planHeartbeats(platform, recordedIds, hcReady, executorMissing, apiKeyM
  * destructive step removes whatever of it is recorded (edge removes its KV
  * namespace with the script).
  *
- * The returned `blocked` lines are reported in `unmanaged`; some accompany a
- * planned step (a secret whose source does not exist yet), because the step
- * still delivers everything that exists.
+ * The returned `blocked` lines are reported in `unmanaged`. A secret whose
+ * source does not exist yet blocks nothing: the step still delivers
+ * everything that exists, so it comes back in `notes`.
  */
 function planUptime(platform, recordedIds, executorBlocked, heldOptional, archonApplied, uptimeHeld = {
     token: true,
@@ -2507,9 +2592,9 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     });
     if (!uptime.enabled) {
         if (!uptimeRecorded(recordedIds))
-            return { step: null, blocked: [] };
+            return { step: null, blocked: [], notes: [] };
         if (executorBlocked)
-            return { step: null, blocked: [executorBlocked] };
+            return { step: null, blocked: [executorBlocked], notes: [] };
         return {
             step: {
                 action: action({ remove: true }),
@@ -2520,6 +2605,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
                 },
             },
             blocked: [],
+            notes: [],
         };
     }
     if (!uptime.tag || !uptime.sha256) {
@@ -2528,6 +2614,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
             blocked: [
                 'the uptime Worker is blocked, not planned: no artifact is pinned; declare uptime.tag (an Archon release tag) and uptime.sha256 (the digest of archon-uptime-worker.js at that tag)',
             ],
+            notes: [],
         };
     }
     if (!archonApplied) {
@@ -2536,16 +2623,25 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
             blocked: [
                 'the uptime Worker is blocked, not planned: platform:archon has not been applied yet',
             ],
+            notes: [],
         };
     }
     if (executorBlocked)
-        return { step: null, blocked: [executorBlocked] };
-    const missing = [];
+        return { step: null, blocked: [executorBlocked], notes: [] };
+    const notes = [];
     if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
-        missing.push(`the uptime Worker has no chat credential (CHAT_ACCESS_TOKEN): hold one under ${PLATFORM_UPTIME_CHAT_TOKEN_REF} and it is set on the next apply; until then it sends no chat alerts`);
+        notes.push({
+            key: 'uptime:CHAT_ACCESS_TOKEN',
+            service: 'uptime',
+            description: `the uptime Worker has no chat credential (CHAT_ACCESS_TOKEN): hold one under ${PLATFORM_UPTIME_CHAT_TOKEN_REF} and it is set on the next apply; until then it sends no chat alerts`,
+        });
     }
     if (!heldOptional.includes('MAIL_API_KEY')) {
-        missing.push(`the uptime Worker has no mail API key (MAIL_API_KEY): hold one under ${PLATFORM_UPTIME_MAIL_KEY_REF} and it is set on the next apply; until then it sends no alert email`);
+        notes.push({
+            key: 'uptime:MAIL_API_KEY',
+            service: 'uptime',
+            description: `the uptime Worker has no mail API key (MAIL_API_KEY): hold one under ${PLATFORM_UPTIME_MAIL_KEY_REF} and it is set on the next apply; until then it sends no alert email`,
+        });
     }
     const hostname = platform.archon.hostname;
     // Applied only once a run got to its end and recorded these: a Worker that
@@ -2561,7 +2657,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
         (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
         recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
     if (applied)
-        return { step: null, blocked: missing };
+        return { step: null, blocked: [], notes };
     return {
         step: {
             action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
@@ -2571,7 +2667,8 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
                 migrates: false,
             },
         },
-        blocked: missing,
+        blocked: [],
+        notes,
     };
 }
 /**
@@ -2709,8 +2806,8 @@ function planArchon(platform, recordedIds, executorBlocked, authReady, drifted,
         Boolean(recordedIds[PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY]) &&
         recordedIds[PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY] ===
             recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY] &&
-        (recordedIds[PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY] ?? 'none') ===
-            (archonBootstrapOperator(recordedIds) ?? 'none') &&
+        recordedIds[PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY] ===
+            archonAuthOrganizationId(recordedIds) &&
         // #475: a platform applied before the rolling-update fix keeps planning
         // this step until a confirmed redeploy has cleared it. #480: this marker
         // alone does not catch the live app's settings changing back afterward
@@ -2775,3 +2872,12 @@ function planArchon(platform, recordedIds, executorBlocked, authReady, drifted,
         blocked: null,
     };
 }
+/** The blocked text for a refused owner-org sign-in domain, while it is recorded and not yet primary. */
+function ownerDomainBlockedText(recordedIds) {
+    const blockedDomain = recordedIds[PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY];
+    if (!blockedDomain)
+        return null;
+    if (recordedIds[PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY] === blockedDomain)
+        return null;
+    return signInDomainBlockedText('the platform owner', blockedDomain).replace(ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY);
+}

package/dist/plan/platform-org.d.ts

@@ -1,3 +1,4 @@
+import { type DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { AgoraHostValues } from './agora.js';
 /**
@@ -61,6 +62,8 @@ export interface OrgPlatformReadiness {
      * while `MAIL_DOMAIN_SCOPE_KEY` was still recorded as the apex.
      */
     platformApex: string | null;
+    /** `DeclaredPlatform.ownerOrgId`, or `null` when no platform is declared or it is empty. The one fact "this is the platform's own org" rests on. */
+    platformOwnerOrgId: string | null;
     /** `DeclaredPlatform.mail.lettermintProjectId`, `null` when undeclared or when no platform is declared. See {@link platformApex}'s own doc comment for why this is unconditional too. */
     platformLettermintProjectId: string | null;
     /** The files host (#171). Files is always on for every org (#80), so `false` always blocks rather than only mattering when a flag is set. */
@@ -149,6 +152,19 @@ export interface OrgPlatformReadiness {
      * A missing key is then reported as "no reader given" instead of "not held".
      */
     noKeyReader?: boolean;
+    /** The platform's declared git ref for each service, which an own org's services deploy. */
+    serviceGitRefs?: {
+        auth: string;
+        mail: string;
+        files: string;
+        jobs: string;
+    };
+    /**
+     * The platform's recorded owner invite (`PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY`): the user id the
+     * platform's files host takes as `AUTHZ_BOOTSTRAP_OPERATOR`, or `'none'` when the platform has no
+     * owner to invite. `null` or absent until recorded. An own org's files host gets the same value.
+     */
+    platformOwnerUserId?: string | null;
 }
 /**
  * What an org's plan reads when no platform is declared: nothing is ready, so
@@ -205,6 +221,26 @@ heldRefs?: ReadonlySet<string>,
 noKeyReader?: boolean, 
 /** #317: true when the host's executor was built with an `EdgePort` ({@link OrgPlatformReadiness.edgeReady}). */
 edgePortPresent?: boolean): OrgPlatformReadiness;
+/** The git refs the platform declares for the services an own org deploys. */
+export declare function serviceGitRefsOf(platform: DeclaredPlatform): {
+    auth: string;
+    mail: string;
+    files: string;
+    jobs: string;
+};
+/** The runner app both the platform's and an own org's files step record. */
+export declare const OWN_FILES_RUNNER_SCOPE_KEY = "coolify_platform_files_runner_app";
+/**
+ * An own org (`services.own`) plans against its own services, so its readiness
+ * reads only its own recorded ids and its own held keys; nothing the shared
+ * services recorded reaches it. AI, edge and Access stay shared and come from
+ * `base`. Any other org gets `base` back unchanged.
+ */
+export declare function orgPlatformReadinessFor(org: DeclaredOrg, base: OrgPlatformReadiness, orgRecordedIds: Readonly<Record<string, string>>, heldRefs: ReadonlySet<string>): OrgPlatformReadiness;
+/** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
+export declare function heldOwnKeyRefs(heldKeys: HeldKeyResolver, org: Pick<DeclaredOrg, 'slug'>): Promise<Set<string>>;
+/** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */
+export declare function agoraHostValuesForOwn(org: DeclaredOrg, orgRecordedIds: Readonly<Record<string, string>>): AgoraHostValues;
 /**
  * #177: {@link AgoraHostValues} derived from the same platform state, rather
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the

package/dist/plan/platform-org.js

@@ -1,6 +1,8 @@
+import { ownsServices } from '../org.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
-import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
-import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
+import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -27,6 +29,7 @@ export const NO_DOMAIN_MAIL_APEX = 'oikos.host';
 export const DEFAULT_ORG_PLATFORM_READINESS = {
     mailHost: null,
     platformApex: null,
+    platformOwnerOrgId: null,
     platformLettermintProjectId: null,
     filesReady: false,
     aiReady: false,
@@ -124,6 +127,8 @@ edgePortPresent = false) {
         // mail.lettermintProjectId are facts regardless of whether mail itself is
         // enabled or applied.
         platformApex: platform.apex,
+        platformOwnerOrgId: platform.ownerOrgId || null,
+        platformOwnerUserId: platformRecordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY] || null,
         platformLettermintProjectId: platform.mail.lettermintProjectId ?? null,
         filesReady: filesApplied && missingKeys.files === null,
         filesUrl: filesApplied
@@ -145,6 +150,95 @@ edgePortPresent = false) {
         ...(noKeyReader ? { noKeyReader } : {}),
     };
 }
+/** The git refs the platform declares for the services an own org deploys. */
+export function serviceGitRefsOf(platform) {
+    return {
+        auth: platform.auth.gitRef,
+        mail: platform.mail.gitRef,
+        files: platform.files.gitRef,
+        jobs: platform.jobs.gitRef,
+    };
+}
+/** The runner app both the platform's and an own org's files step record. */
+export const OWN_FILES_RUNNER_SCOPE_KEY = 'coolify_platform_files_runner_app';
+const OWN_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+/** Resource id of an own-service step, in `AppliedState.serviceIds`' `system:kind:key` form. */
+function ownStepRecorded(ids, org, kind) {
+    return Boolean(ids[`coolify:${kind}:${org.id}`]);
+}
+/**
+ * The own org's sign-in is up: applied, so its ZITADEL answers. The broker and the login client
+ * come after the org's first broker entry, as the platform's do after its first registration, so
+ * waiting for them here would wait for the very steps this gate lets run.
+ */
+function ownAuthReady(ids) {
+    return Boolean(ids[OWN_SERVICES_APPLIED_SCOPE_KEY]);
+}
+/**
+ * An own org (`services.own`) plans against its own services, so its readiness
+ * reads only its own recorded ids and its own held keys; nothing the shared
+ * services recorded reaches it. AI, edge and Access stay shared and come from
+ * `base`. Any other org gets `base` back unchanged.
+ */
+export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
+    if (!ownsServices(org))
+        return base;
+    const refs = orgTarget(org).refs;
+    const authReady = ownAuthReady(orgRecordedIds);
+    const filesApplied = ownStepRecorded(orgRecordedIds, org, 'own-files') &&
+        Boolean(orgRecordedIds[OWN_FILES_RUNNER_SCOPE_KEY]);
+    const jobsApplied = ownStepRecorded(orgRecordedIds, org, 'own-jobs');
+    const mailApplied = ownStepRecorded(orgRecordedIds, org, 'own-mail') &&
+        Boolean(orgRecordedIds[OWN_MAIL_APP_SCOPE_KEY]);
+    const filesUrl = orgRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY];
+    const jobsUrl = orgRecordedIds[JOBS_INTERNAL_URL_SCOPE_KEY];
+    const missing = (applied, ref) => applied && !heldRefs.has(ref) ? ref : null;
+    const missingKeys = {
+        files: missing(filesApplied, refs.filesManagement),
+        ai: base.missingKeys.ai,
+        jobs: missing(jobsApplied, refs.jobsAdminToken),
+    };
+    const { jobsUrlMissing: _shared, ...rest } = base;
+    return {
+        ...rest,
+        authReady,
+        authIssuer: authReady && org.domain ? `https://auth.${org.domain}` : null,
+        filesReady: filesApplied && filesUrl !== undefined && missingKeys.files === null,
+        filesUrl: filesApplied ? (filesUrl ?? null) : null,
+        jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
+        ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
+        callsReady: ownStepRecorded(orgRecordedIds, org, 'own-sfu'),
+        mailHost: mailApplied && org.domain && base.mailHost
+            ? { apex: org.domain, mailHost: base.mailHost.mailHost }
+            : null,
+        missingKeys,
+    };
+}
+/** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
+export async function heldOwnKeyRefs(heldKeys, org) {
+    const held = new Set();
+    for (const ref of Object.values(orgTarget(org).refs)) {
+        try {
+            if (await heldKeys.resolve(ref))
+                held.add(ref);
+        }
+        catch {
+            // not held
+        }
+    }
+    return held;
+}
+/** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */
+export function agoraHostValuesForOwn(org, orgRecordedIds) {
+    const authReady = ownAuthReady(orgRecordedIds);
+    return {
+        issuer: authReady && org.domain ? `https://auth.${org.domain}` : null,
+        mailProjectId: orgRecordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY] ?? null,
+        messagingProjectId: null,
+        mailUpstream: orgRecordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] ?? null,
+        filesUpstream: orgRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null,
+    };
+}
 /**
  * #177: {@link AgoraHostValues} derived from the same platform state, rather
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the